userapi: add seed to protocol; seedengine: implement key derivation

[katexochen]

First step for Coordinator recovery.

• The UserAPI protocol is extended with a field for the seed shares document, which will in the future contain the seed (recovery secret) encrypted once with each workload owner key defined in the manifest
• The seedengine takes an initial seed and salt and deterministically derives the required ECDSA keys and symmetric secrets.

While the seedengine is dead code for now, the userapi protocol change will be live, but no seed will be sent for now, and now file will be printed on the client side.

[CLAassistant]

All committers have signed the CLA.